@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/{frontend/src/lib/analysis/brand-profile-model.js → packages/workspace/brand-profile-model.mjs}

@@ -1,30 +1,14 @@
 // Pure Brand Profile normalization and storage model. The browser wrapper owns
 // persistence and downloads; this module owns schema migration, semantic field
 // bounds, import merging, and exact serialized-byte accounting.
-import { normalizeDomain } from "./case-model.js";
-import { normalizePageBaseline } from "./page-baseline.js";
-import { isInformativeFaviconHash } from "./utils.js";
-export const BRAND_PROFILE_SCHEMA = 'whoisleuth.brand-profiles';
-export const BRAND_PROFILE_SCHEMA_VERSION = 6;
-export const MAX_PROFILES = 100;
-export const MAX_PROFILE_VALUES = 200;
-export const MAX_PROFILE_VALUE_INPUTS = MAX_PROFILE_VALUES * 4;
-// Profiles share the origin's browser-storage quota with cases, campaigns,
-// watchlists, and CT history. Fail at a predictable one-megabyte boundary.
-export const MAX_PROFILE_STORE_BYTES = 1024 * 1024;
-export const MAX_PROFILE_NAME_LENGTH = 100;
-export const MAX_PROFILE_TEXT_LENGTH = 200;
-export const MAX_PROFILE_DOMAIN_LENGTH = 253;
-export const MAX_PROFILE_TLD_LENGTH = 63;
-export const MAX_DKIM_SELECTOR_LENGTH = 253;
-export const MAX_DKIM_SELECTORS = 10;
-export const MAX_PROTECTION_ATTESTATIONS = 6;
-export const MAX_DESIRED_POSTURE_BASELINES = 20;
-export const MAX_DESIRED_POSTURE_RECORDS = 32;
-export const MAX_DESIRED_POSTURE_SUPPRESSIONS = 12;
-export const MAX_DESIRED_POSTURE_OBSERVATIONS = 12;
-export const MAX_DESIRED_POSTURE_CHANGE_WINDOWS = 8;
-const SAFE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/;
+import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { normalizeOpaqueReferenceId } from "../cases/opaque-reference-id.mjs";
+import { normalizePageBaseline } from "./page-baseline.mjs";
+import { isInformativePerceptualHash as isInformativeFaviconHash } from "../../lib/perceptual-hash-comparison.mjs";
+import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
+import { BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, MAX_DESIRED_POSTURE_BASELINES, MAX_DESIRED_POSTURE_CHANGE_WINDOWS, MAX_DESIRED_POSTURE_OBSERVATIONS, MAX_DESIRED_POSTURE_RECORDS, MAX_DESIRED_POSTURE_SUPPRESSIONS, MAX_DKIM_SELECTOR_LENGTH, MAX_DKIM_SELECTORS, MAX_PROFILES, MAX_PROFILE_DOMAIN_LENGTH, MAX_PROFILE_NAME_LENGTH, MAX_PROFILE_STORE_BYTES, MAX_PROFILE_TEXT_LENGTH, MAX_PROFILE_TLD_LENGTH, MAX_PROFILE_VALUE_INPUTS, MAX_PROFILE_VALUES, MAX_PROTECTION_ATTESTATIONS, SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
+export { BRAND_PROFILE_SCHEMA, BRAND_PROFILE_SCHEMA_VERSION, MAX_DESIRED_POSTURE_BASELINES, MAX_DESIRED_POSTURE_CHANGE_WINDOWS, MAX_DESIRED_POSTURE_OBSERVATIONS, MAX_DESIRED_POSTURE_RECORDS, MAX_DESIRED_POSTURE_SUPPRESSIONS, MAX_DKIM_SELECTOR_LENGTH, MAX_DKIM_SELECTORS, MAX_PROFILES, MAX_PROFILE_DOMAIN_LENGTH, MAX_PROFILE_NAME_LENGTH, MAX_PROFILE_STORE_BYTES, MAX_PROFILE_TEXT_LENGTH, MAX_PROFILE_TLD_LENGTH, MAX_PROFILE_VALUE_INPUTS, MAX_PROFILE_VALUES, MAX_PROTECTION_ATTESTATIONS, SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS, } from "../contracts/workspace-portability.mjs";
 const SHA256_RE = /^[a-f0-9]{64}$/i;
 const CONTROL_RE = /[\x00-\x1f\x7f]/;
 const DNS_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -45,7 +29,7 @@ const PROTECTION_ATTESTATION_STATES = new Set([
     'unavailable',
     'not_applicable',
 ]);
-const DESIRED_POSTURE_FIELDS = new Set([
+export const DESIRED_POSTURE_SUPPRESSION_FIELDS = Object.freeze([
     'nameservers',
     'ds',
     'mx',
@@ -56,11 +40,10 @@ const DESIRED_POSTURE_FIELDS = new Set([
     'registrar_lock',
     'renewal_review',
 ]);
+const DESIRED_POSTURE_FIELDS = new Set(DESIRED_POSTURE_SUPPRESSION_FIELDS);
 const POSTURE_CHECK_STATUSES = new Set(['danger', 'info', 'pass', 'warning']);
 function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : {};
+    return ordinaryWorkspaceRecord(value, 'Brand Profile input') ?? {};
 }
 function boundedText(value, maximum = MAX_PROFILE_TEXT_LENGTH) {
     if (typeof value !== 'string' || CONTROL_RE.test(value))
@@ -68,15 +51,16 @@ function boundedText(value, maximum = MAX_PROFILE_TEXT_LENGTH) {
     return value.slice(0, maximum * 4).replace(/\s+/g, ' ').trim().slice(0, maximum).trim();
 }
 export function normalizeBrandProfileId(value) {
-    return typeof value === 'string' && SAFE_ID_RE.test(value) ? value : null;
+    return normalizeOpaqueReferenceId(value);
 }
 function timestamp(value, fallback) {
-    if (typeof value === 'string' && value.length <= 64 && !CONTROL_RE.test(value)) {
-        const parsed = Date.parse(value);
-        if (Number.isFinite(parsed))
-            return new Date(parsed).toISOString();
+    return normalizeExplicitIsoTimestamp(value) ?? fallback;
+}
+function calendarTimestamp(value, fallback) {
+    if (typeof value === 'string' && /^\d{4}-\d{2}-\d{2}$/u.test(value)) {
+        return normalizeExplicitIsoTimestamp(`${value}T00:00:00Z`) ?? fallback;
     }
-    return fallback;
+    return timestamp(value, fallback);
 }
 function normalizeTld(value) {
     if (typeof value !== 'string' || CONTROL_RE.test(value))
@@ -156,7 +140,7 @@ export function normalizeProtectionAttestations(value) {
             control: candidate.control,
             state: candidate.state,
             assertedAt,
-            expiresAt: timestamp(candidate.expiresAt, null),
+            expiresAt: calendarTimestamp(candidate.expiresAt, null),
             note: boundedText(candidate.note),
         });
         if (output.length >= MAX_PROTECTION_ATTESTATIONS)
@@ -217,10 +201,25 @@ function normalizeDesiredPostureObservationHistory(value, previous) {
         .sort((left, right) => Date.parse(left.observedAt) - Date.parse(right.observedAt))
         .slice(-MAX_DESIRED_POSTURE_OBSERVATIONS);
 }
-function normalizeDesiredPostureChangeWindows(value) {
+function deterministicChangeWindowId(seed) {
+    const states = [0x811c9dc5, 0x9e3779b9, 0x85ebca6b, 0xc2b2ae35];
+    const factors = [0x01000193, 0x85ebca6b, 0xc2b2ae35, 0x27d4eb2f];
+    for (let index = 0; index < seed.length; index += 1) {
+        const code = seed.charCodeAt(index);
+        for (let stateIndex = 0; stateIndex < states.length; stateIndex += 1) {
+            const state = states[stateIndex] ?? 0;
+            const mixed = state ^ (code + Math.imul(index + 1, stateIndex + 17));
+            states[stateIndex] = Math.imul(mixed, factors[stateIndex] ?? 0x01000193);
+        }
+    }
+    return `cw-${states.map((state) => (state >>> 0).toString(16).padStart(8, '0')).join('')}`;
+}
+function normalizeDesiredPostureChangeWindows(value, identityScope = '') {
     if (!Array.isArray(value))
         return [];
     const output = [];
+    const seenIds = new Set();
+    const duplicateMaterial = new Map();
     for (const item of value.slice(0, MAX_DESIRED_POSTURE_CHANGE_WINDOWS * 4)) {
         const candidate = record(item);
         const startsAt = timestamp(candidate.startsAt, null);
@@ -228,7 +227,17 @@ function normalizeDesiredPostureChangeWindows(value) {
         const summary = boundedText(candidate.summary, 300);
         if (!startsAt || !endsAt || Date.parse(endsAt) <= Date.parse(startsAt) || !summary)
             continue;
-        output.push({ startsAt, endsAt, summary });
+        const material = `${startsAt}\u001f${endsAt}\u001f${summary}`;
+        const occurrence = duplicateMaterial.get(material) ?? 0;
+        duplicateMaterial.set(material, occurrence + 1);
+        let id = normalizeOpaqueReferenceId(candidate.id);
+        let salt = 0;
+        while (!id || seenIds.has(id)) {
+            id = deterministicChangeWindowId(`${identityScope}\u001f${material}\u001f${occurrence}\u001f${salt}`);
+            salt += 1;
+        }
+        seenIds.add(id);
+        output.push({ id, startsAt, endsAt, summary });
         if (output.length >= MAX_DESIRED_POSTURE_CHANGE_WINDOWS)
             break;
     }
@@ -250,7 +259,7 @@ function normalizeTlsSanPatterns(value) {
     }
     return [...output].sort();
 }
-export function normalizeDesiredPostureBaselines(value, officialDomains, fallbackNow = new Date().toISOString()) {
+export function normalizeDesiredPostureBaselines(value, officialDomains, fallbackNow = new Date().toISOString(), identityScope = '') {
     if (!Array.isArray(value))
         return [];
     const allowedDomains = new Set(officialDomains);
@@ -275,7 +284,7 @@ export function normalizeDesiredPostureBaselines(value, officialDomains, fallbac
             suppressions.push({
                 field,
                 reason,
-                expiresAt: timestamp(suppression.expiresAt, null),
+                expiresAt: calendarTimestamp(suppression.expiresAt, null),
             });
             if (suppressions.length >= MAX_DESIRED_POSTURE_SUPPRESSIONS)
                 break;
@@ -298,7 +307,7 @@ export function normalizeDesiredPostureBaselines(value, officialDomains, fallbac
             registrarLock: ['required', 'not_required'].includes(String(candidate.registrarLock))
                 ? candidate.registrarLock
                 : 'unconfigured',
-            renewalReviewAt: timestamp(candidate.renewalReviewAt, null),
+            renewalReviewAt: calendarTimestamp(candidate.renewalReviewAt, null),
             zoneIntent: ['active_service', 'defensive_registration', 'no_service', 'parked', 'redirect_only'].includes(String(candidate.zoneIntent))
                 ? candidate.zoneIntent
                 : 'unconfigured',
@@ -306,7 +315,7 @@ export function normalizeDesiredPostureBaselines(value, officialDomains, fallbac
                 ? candidate.lifecycle
                 : 'active',
             recoveryDependency: boundedText(candidate.recoveryDependency, 200),
-            approvedChangeWindows: normalizeDesiredPostureChangeWindows(candidate.approvedChangeWindows),
+            approvedChangeWindows: normalizeDesiredPostureChangeWindows(candidate.approvedChangeWindows, `${identityScope}\u001f${domain}`),
             suppressions,
             note: boundedText(candidate.note, MAX_PROFILE_TEXT_LENGTH),
             previousObservation: observationHistory.at(-1) ?? previousObservation,
@@ -331,9 +340,12 @@ export function normalizeBrandProfile(raw, options = {}) {
     const now = timestamp(options.nowIso, new Date().toISOString());
     const officialDomains = normalizeProfileDomains(value.officialDomains);
     const dkimSelectors = normalizeDkimSelectors(value.dkimSelectors);
-    const candidateBaseline = Object.prototype.hasOwnProperty.call(value, 'pageBaseline')
+    const suppliedBaseline = Object.prototype.hasOwnProperty.call(value, 'pageBaseline');
+    const candidateBaseline = suppliedBaseline
         ? normalizePageBaseline(value.pageBaseline)
         : normalizePageBaseline(existing?.pageBaseline);
+    const baselineDomainMismatch = suppliedBaseline && candidateBaseline !== null
+        && !officialDomains.includes(candidateBaseline.domain);
     const pageBaseline = candidateBaseline && officialDomains.includes(candidateBaseline.domain)
         ? candidateBaseline
         : null;
@@ -358,11 +370,11 @@ export function normalizeBrandProfile(raw, options = {}) {
             .filter((selector) => !dkimSelectors.includes(selector)),
         mailProtectionProfile: normalizeMailProtectionProfile(value.mailProtectionProfile),
         protectionAttestations: normalizeProtectionAttestations(value.protectionAttestations),
-        desiredPostureBaselines: normalizeDesiredPostureBaselines(value.desiredPostureBaselines, officialDomains, now),
+        desiredPostureBaselines: normalizeDesiredPostureBaselines(value.desiredPostureBaselines, officialDomains, now, profileId),
         trademarkOwner: boundedText(value.trademarkOwner),
         trademarkRegistration: boundedText(value.trademarkRegistration),
-        officialFaviconHash: normalizeFaviconHash(value.officialFaviconHash),
-        officialFaviconPHash: normalizeFaviconPHash(value.officialFaviconPHash),
+        officialFaviconHash: baselineDomainMismatch ? '' : normalizeFaviconHash(value.officialFaviconHash),
+        officialFaviconPHash: baselineDomainMismatch ? '' : normalizeFaviconPHash(value.officialFaviconPHash),
         pageBaseline,
         createdAt,
         updatedAt: options.touch === true ? now : timestamp(value.updatedAt, createdAt),
@@ -376,15 +388,24 @@ function profileList(raw) {
 }
 export function brandProfileStoreVersion(raw) {
     if (Array.isArray(raw))
-        return 1;
+        return BRAND_PROFILE_SCHEMA_VERSION;
     const value = record(raw);
     return typeof value.version === 'number' && Number.isFinite(value.version) && value.version > 0 ? value.version : null;
 }
 /** Normalize an internal profile collection or current stored envelope. */
 export function normalizeBrandProfileStore(raw) {
+    assertWorkspaceInputGraph(raw, 'Brand Profile store');
+    assertWorkspaceDeclaredVersion(raw, 'Brand Profile store');
+    const sourceVersion = brandProfileStoreVersion(raw);
+    if (!Array.isArray(raw) && sourceVersion !== null
+        && !SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS.includes(sourceVersion)) {
+        throw new Error(`Brand Profile schema ${sourceVersion} is unsupported; no data was changed.`);
+    }
     const byId = new Map();
     for (const item of profileList(raw).slice(0, MAX_PROFILES * 4)) {
-        const profile = normalizeBrandProfile(item);
+        const profile = normalizeBrandProfile(item, {
+            nowIso: new Date(0).toISOString(),
+        });
         if (!profile)
             continue;
         const previous = byId.get(profile.id);
@@ -409,6 +430,9 @@ export function assertBrandProfileStoreBudget(profiles) {
     return store;
 }
 export function mergeBrandProfiles(localRaw, importedRaw, options = {}) {
+    assertWorkspaceInputGraph(localRaw, 'Local Brand Profile store');
+    assertWorkspaceInputGraph(importedRaw, 'Imported Brand Profile document');
+    assertWorkspacePortableVersion(importedRaw, BRAND_PROFILE_SCHEMA_VERSION, 'Imported Brand Profile document');
     const imported = record(importedRaw);
     if (imported.schema !== BRAND_PROFILE_SCHEMA) {
         throw new Error('This JSON file is not a WHOISleuth Brand Profile export.');
@@ -420,17 +444,39 @@ export function mergeBrandProfiles(localRaw, importedRaw, options = {}) {
     if (importedVersion !== null && importedVersion > BRAND_PROFILE_SCHEMA_VERSION) {
         throw new Error(`This Brand Profile file uses newer schema ${importedVersion}. Update the app before importing it.`);
     }
-    if (![2, 3, 4, 5, BRAND_PROFILE_SCHEMA_VERSION].includes(importedVersion ?? 0)) {
-        throw new Error(`Expected a WHOISleuth Brand Profile export using schema 2, 3, 4, 5, or ${BRAND_PROFILE_SCHEMA_VERSION}.`);
+    if (!SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS.includes(importedVersion ?? 0)) {
+        throw new Error(`Expected a WHOISleuth Brand Profile export using schema ${SUPPORTED_BRAND_PROFILE_SCHEMA_VERSIONS.join(', ').replace(/, ([^,]+)$/u, ', or $1')}.`);
+    }
+    const idNames = new Map();
+    const retainIdName = (id, name) => {
+        const nameKey = name.toLowerCase();
+        const previous = idNames.get(id);
+        if (previous !== undefined && previous !== nameKey) {
+            throw new Error('Brand Profile import reuses one exact identifier for different normalised profile names. No profiles were imported.');
+        }
+        idNames.set(id, nameKey);
+    };
+    for (const item of profileList(localRaw).slice(0, MAX_PROFILES * 4)) {
+        const value = record(item);
+        const id = normalizeBrandProfileId(value.id);
+        const name = boundedText(value.name, MAX_PROFILE_NAME_LENGTH);
+        if (id && name)
+            retainIdName(id, name);
     }
     const local = normalizeBrandProfileStore(localRaw).profiles;
+    for (const profile of local)
+        retainIdName(profile.id, profile.name);
     const byName = new Map(local.map((profile) => [profile.name.toLowerCase(), profile]));
     const input = profileList(importedRaw);
     let added = 0;
     let updated = 0;
     let skipped = Math.max(0, input.length - MAX_PROFILES * 4);
     for (const item of input.slice(0, MAX_PROFILES * 4)) {
-        const rawName = boundedText(record(item).name, MAX_PROFILE_NAME_LENGTH);
+        const value = record(item);
+        const rawName = boundedText(value.name, MAX_PROFILE_NAME_LENGTH);
+        const rawId = normalizeBrandProfileId(value.id);
+        if (rawId && rawName)
+            retainIdName(rawId, rawName);
         const existing = rawName ? byName.get(rawName.toLowerCase()) : null;
         const profile = normalizeBrandProfile(item, {
             existing,
@@ -442,6 +488,7 @@ export function mergeBrandProfiles(localRaw, importedRaw, options = {}) {
             skipped++;
             continue;
         }
+        retainIdName(profile.id, profile.name);
         if (existing) {
             byName.set(profile.name.toLowerCase(), profile);
             updated++;

package/{frontend/src/lib/analysis/bulk-review-model.js → packages/workspace/bulk-review-model.mjs}

@@ -1,14 +1,13 @@
-import { normalizeDomain } from "./case-model.js";
-export const BULK_REVIEW_SCHEMA = 'whoisleuth.bulk-review';
-export const BULK_REVIEW_SCHEMA_VERSION = 1;
-export const MAX_BULK_REVIEW_PRESETS = 24;
-export const MAX_BULK_REVIEW_ROWS = 1_900;
-export const MAX_BULK_REVIEW_STORE_BYTES = 512 * 1024;
-export const MAX_BULK_REVIEW_NAME_LENGTH = 80;
+import { normalizeDomain } from "../cases/case-model.mjs";
+import { normalizeBulkPresentationSortKey } from "./bulk-sort.mjs";
+import { normalizeExplicitIsoTimestamp } from "../evidence/observation.mjs";
+import { assertWorkspaceDeclaredVersion, assertWorkspaceInputGraph, assertWorkspacePortableVersion, ordinaryWorkspaceRecord } from "./hostile-input.mjs";
+import { BULK_REVIEW_SCHEMA, BULK_REVIEW_SCHEMA_VERSION, MAX_BULK_REVIEW_NAME_LENGTH, MAX_BULK_REVIEW_PRESETS, MAX_BULK_REVIEW_ROWS, MAX_BULK_REVIEW_STORE_BYTES, } from "../contracts/workspace-portability.mjs";
+export { BULK_REVIEW_SCHEMA, BULK_REVIEW_SCHEMA_VERSION, MAX_BULK_REVIEW_NAME_LENGTH, MAX_BULK_REVIEW_PRESETS, MAX_BULK_REVIEW_ROWS, MAX_BULK_REVIEW_STORE_BYTES, } from "../contracts/workspace-portability.mjs";
 export const BULK_REVIEW_STATES = ['unreviewed', 'reviewing', 'reviewed', 'deferred'];
 const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
 const SAFE_ID_RE = /^[A-Za-z0-9_-]{1,128}$/u;
-const PRIMARY_FILTERS = new Set(['all', 'available', 'registered', 'high_risk', 'trusted', 'errors']);
+const PRIMARY_FILTERS = new Set(['all', 'available', 'registered', 'high_risk', 'trusted', 'profile_unevaluated', 'errors']);
 const SOURCE_FILTERS = new Set(['', 'complete', 'limited', 'failed']);
 const LIFECYCLE_FILTERS = new Set(['', 'new', 'expiring', 'aged', 'unknown']);
 const AGE_FILTERS = new Set(['', '7d', '30d', '90d', '365d', 'older', 'unknown']);
@@ -19,9 +18,7 @@ const REVIEW_STATES = new Set(BULK_REVIEW_STATES);
 const CASE_DISPOSITIONS = new Set(['', 'untracked', 'unreviewed', 'suspicious', 'confirmed_abuse', 'false_positive', 'expected', 'closed_no_action']);
 const SIGNAL_FILTERS = new Set(['favicon', 'password', 'phishing', 'asset_reuse', 'idn']);
 function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : {};
+    return ordinaryWorkspaceRecord(value, 'Bulk-review input') ?? {};
 }
 function text(value, maximum) {
     if (typeof value !== 'string' || CONTROL_RE.test(value))
@@ -29,9 +26,7 @@ function text(value, maximum) {
     return value.trim().slice(0, maximum);
 }
 function timestamp(value, fallback) {
-    const normalized = text(value, 64);
-    const parsed = Date.parse(normalized);
-    return Number.isFinite(parsed) ? new Date(parsed).toISOString() : fallback;
+    return normalizeExplicitIsoTimestamp(value) ?? fallback;
 }
 function safeId(value) {
     return typeof value === 'string' && SAFE_ID_RE.test(value) ? value : '';
@@ -50,7 +45,7 @@ function normalizeView(raw) {
         ? [...new Set(value.signalFilters.filter((item) => typeof item === 'string' && SIGNAL_FILTERS.has(item)))].slice(0, SIGNAL_FILTERS.size)
         : [];
     const sortKey = typeof value.sortKey === 'string' && SORT_KEYS.has(value.sortKey)
-        ? value.sortKey
+        ? normalizeBulkPresentationSortKey(value.sortKey)
         : 'risk';
     return {
         primaryFilter: setValue(value.primaryFilter, PRIMARY_FILTERS, 'all'),
@@ -110,6 +105,8 @@ function sourceLists(raw) {
     };
 }
 export function normalizeBulkReviewStore(raw) {
+    assertWorkspaceInputGraph(raw, 'Bulk-review store');
+    assertWorkspaceDeclaredVersion(raw, 'Bulk-review store');
     const fallback = new Date(0).toISOString();
     const source = sourceLists(raw);
     const presets = new Map();
@@ -207,6 +204,9 @@ export function buildBulkReviewExport(raw) {
     return enforceBulkReviewBudget(raw);
 }
 export function mergeBulkReviewStores(localRaw, importedRaw) {
+    assertWorkspaceInputGraph(localRaw, 'Local Bulk-review store');
+    assertWorkspaceInputGraph(importedRaw, 'Imported Bulk-review document');
+    assertWorkspacePortableVersion(importedRaw, BULK_REVIEW_SCHEMA_VERSION, 'Imported Bulk-review document');
     const importedRecord = record(importedRaw);
     if (importedRecord.schema !== BULK_REVIEW_SCHEMA) {
         throw new Error('This file is not a WHOISleuth Bulk review export.');